08 May 15:15

ed8a665

v2.4.3

Spin 2.4.3

This is a security patch release to resolve GHSA-f3h7-gpjj-wcvh

Fix: ed8a665

Verifying the Release Signature 🔏

After downloading the v2.4.3 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.4.3 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

Addendum: Due to #2502, the `spin-v2.4.3-macos-amd64.tar.gz` archive has been rebuilt, signed and uploaded manually.

The user identity that signed the artifact is @vdice via GitHub OAuth, so the full verification command is as follows:

cosign verify-blob \
  --signature spin.sig \
  --certificate crt.pem \
  --certificate-identity [email protected] \
  --certificate-oidc-issuer https://github.com/login/oauth \
  spin

Full Changelog: v2.4.2...v2.4.3

Contributors

vdice

Assets 10

04 Apr 01:42

github-actions

v2.4.2

340378e

v2.4.2

Spin 2.4.2

This is a patch release to fix a bug that was found in the outgoing-mqtt host component implementation when publishing messages with a QoS level of 2.

Verifying the Release Signature 🔏

After downloading the v2.4.2 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.4.2 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

Full Changelog: v2.4.1...v2.4.2

Assets 10

02 Apr 21:49

github-actions

v2.4.1

59d17f7

v2.4.1

Spin 2.4.1

This is a patch release to fix a bug that was found in the outgoing-mqtt host component implementation.

Verifying the Release Signature 🔏

After downloading the v2.4.1 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.4.1 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

Full Changelog: v2.4.0...v2.4.1

Assets 10

28 Mar 19:23

github-actions

v2.4.0

1172824

v2.4.0

Spin v2.4

The v2.4 release of Spin brings a number of features, improvements and bug fixes.

Some highlights in v2.4.0 at a glace:

experimental support for the OpenTelemetry (OTEL) observability standard (#2348). When configured Spin will now emit traces of your Spin App as an OTEL signal.
service chaining (#2305) to remove the overhead of network requests when Spin app components call each other.

If curious about the vision for service chaining and other efforts, check out the SIP (Spin Improvement Proposal) directory. Perhaps it will spark an idea for a SIP of your own!

As always, thanks to contributors old and new for helping improve Spin on a daily basis! 🎉

Verifying the Release Signature

After downloading the 2.4.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.4.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

fix cross-rs cmake config and update cargo config for static build targets by @rajatjindal in #2307
feat(oci): update dkregistry dep to support ACR login by @vdice in #2308
fix push-templates-tag grep pattern by @dicej in #2313
Subdomain wildcards by @itowlson in #2314
chore(release): Bump version to 2.4.0-pre0 by @lann in #2312
point Go templates to v2.2.0 instead of main by @dicej in #2317
Tweak spin-loader to be able to run in Wasm by @rylev in #2304
fix(example): update variables example to use constant time comparison by @kate-goldenring in #2311
fix(cmd/up): --help takes precedence over --build by @endocrimes in #2324
fix(oci/config): ensure unique OCI image config by @radu-matei in #2322
Feature/mqtt publisher by @suneetnangia in #2287
feat(loader): support loading AOT compiled components by @kate-goldenring in #2318
Use the bundled version of paho and remove vendored openssl by @rylev in #2328
Use rumqttc instead of paho-mqtt by @itowlson in #2330
Variables in redis.address and allowed_outbound_hosts by @itowlson in #2299
allow redis trigger to connect to multiple servers by @karthik2804 in #2242
outbound-networking: Don't pass &Arc unnecessarily by @lann in #2342
Fixed issue around swallowing mqtt publish errors. by @suneetnangia in #2344
Service chaining SIP by @itowlson in #2290
Enable templating of Redis trigger channel by @itowlson in #2346
Remove credentials before printing Redis subscriptions by @itowlson in #2349
set host header on self outbound requests by @karthik2804 in #2298
handle connection errors on redis-trigger init by @karthik2804 in #2350
Because I can never remember if it's --temp or --tmp by @itowlson in #2357
Inherit workspace metadata by @fibonacci1729 in #2351
update spin-timer mio version to 0.8.11 by @dicej in #2359
add ability to specify env vars for spin build in test runner by @karthik2804 in #2360
Seize control of the means of producing 404s by @itowlson in #2363
Fix build when RUSTFLAGS is set for native builds by @alexcrichton in #2365
core: Remove unnecessary Arc from (Module)InstancePre by @lann in #2367
Refactor TriggerExecutor to have associated types for instances by @alexcrichton in #2366
added no_vcs flag by @thesuhas in #2370
Add missing wasi:random/insecure{,_seed} interfaces by @alexcrichton in #2374
Remove unused dependency that was causing a cycle by @itowlson in #2375
nit: fix label on openssl setup by @rajatjindal in #2372
use ubuntu 20.04 for PR workflow to make it consistent with release workflow by @rajatjindal in #2378
ci: Include os-release in cache key by @lann in #2383
Less worse error if file mount source doesn't exist by @itowlson in #2384
Service chaining by @itowlson in #2305
update cosign-installer and cosign version by @rajatjindal in #2385
testing-framework: Add HEALTHCHECK to vault.Dockerfile by @lann in #2382
More forgiving caching by @itowlson in #2377
Create assets directory from fileserver template by @itowlson in #2387
feat(*): Implement the skeleton of an OTEL observability system by @calebschoepp in #2348
Remove dead code newly discovered by Rust 1.77.0 by @rylev in #2389
Allow spin-expressions and spin-outbound-networking to compile to wasm by @rylev in #2390
Fix spin add static-fileserver putting the asset directory in the wrong place by @itowlson in #2388
Update libsql to latest version by @rylev in #2394
chore(release): update version for 2.4 release by @kate-goldenring in #2399

New Contributors

@thesuhas made their first contribution in #2370

Full Changelog: v2.3.1...v2.4.0

Contributors

alexcrichton, lann, and 13 other contributors

Assets 10

08 Mar 00:32

github-actions

v2.3.1

22c2ac5

v2.3.1

Spin 2.3.1

This is a patch release of Spin to enable fuller functionality in the Spin containerd shim.

Changes

#2322 updates the OCI crate to set the digest of the locked Spin application in the OCI image config to ensure that image config digests are updated when Spin apps are updated. This resolves an issue with the Spin containerd shim serving outdated content due to the image config digest not updating.
#2318 add support for loading precompiled Spin applications. This can provide performance improvements for users of the crate, such as the Spin containerd shim.

Verifying the Release Signature 🔏

After downloading the v2.3.1 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.3.1 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

Full Changelog: v2.3.0...v2.3.1

Assets 10

01 Mar 14:10

github-actions

v2.3.0

ee6706c

v2.3.0

Spin 2.3.0

The 2.3.0 release of Spin brings a number of features, improvements and bug fixes.

Some highlights in 2.3.0 at a glance:

Runtime upgraded to Wasmtime 18
The Rust and Go SDKs have moved into their own repositories:
- https://github.com/fermyon/spin-rust-sdk
- https://github.com/fermyon/spin-go-sdk
Multi-trigger improvements:
- spin add can now add components with different trigger types (#2269)
- Better handling of trigger-specific flags in spin up (#2266)
spin registry login now supports Azure Container Registry

As always, thanks to contributors old and new for helping improve Spin on a daily basis! 🎉

Verifying the Release Signature

After downloading the 2.3.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.3.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha ee6706c8df54243c0689e648548217d142ff037a \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

chore(*): post-2.2.0 release bumps by @vdice in #2264
Move wasi-http integration tests over to new testing framework by @rylev in #2247
Enable spin add to add different trigger types by @itowlson in #2269
Rename spin-redis-engine -> spin-trigger-redis by @lann in #2271
Fix test components build by @lann in #2272
Multi-trigger: ask triggers which flags they can accept by @itowlson in #2266
update spin-timer deps by @dicej in #2273
tests: Migrate wagi test to integration test suite by @lann in #2274
update python tests to use componentize-py template by @karthik2804 in #2275
Update template to use PHP 8.2 by @technosophos in #2276
Make sure runtime tests run in CI by @rylev in #2268
Migrate spin inbound-http test to integration test suite by @lann in #2277
In process runtime tests by @rylev in #2281
unify WIT files by @dicej in #2283
Upgrade wasmtime to 17.0.1 by @lann in #2288
move Rust and Go SDKs to their own repos by @dicej in #2289
Upgrade to wasmtime 18 by @rylev in #2291
update plugin install prompt to deal with line wrapping by @karthik2804 in #2295
Put back the test-crate make target by @itowlson in #2297
Bring spin-componentize in tree by @rylev in #2294
fix(manifest): support kebab case labels by @kate-goldenring in #2300
chore(release): Spin v2.3 version bumps by @lann in #2302
[Backport v2.3] feat(oci): update dkregistry dep to support ACR login by @lann in #2310

Full Changelog: v2.2.0...v2.3.0

Contributors

technosophos, lann, and 6 other contributors

Assets 10

30 Jan 23:17

github-actions

v2.2.0

eebfae1

v2.2.0

Spin 2.2.0

This release of Spin brings a number of features, improvements and bug fixes.

Some highlights in v2.2.0 at a glance:

Initial multi-trigger support has been added to Spin, thanks to new contributor @carlokok!
- We'll still be working on this feature post-2.2.0 and will add docs/examples to the Developer site once stabilized.
Spin has been updated to use Wasmtime 17 and WASI 0.2.0
The Websockets SIP has been merged
Massive testing improvements from @rylev, including restructuring for gains in efficiency, devex and de-duplication
- See the main tracking issue for overarching goals
- PRs to note:
  - #2217
  - #2223
  - #2228
  - #2180
- If curious, start familiarizing yourself with the new framework(s) here

Additional features worth mentioning:

A new set_header method on the http Request object: #2187
The active channel is now printed for Redis trigger apps: #2232
Addition of a Spin app example using Hashicorp Vault for variables: #2241
Some helpful logging when wasm components are slow to load: #2226 by new contributor @Archisman-Mridha!

As always, thanks to contributors old and new for helping improve Spin on a daily basis! 🎉

Verifying the Release Signature

After downloading the v2.2.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.2.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha eebfae1d6de6a166da16ec8858332f4cc3b6c557 \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

Remove redundant variables test by @rylev in #2172
allowed_outbound_host CIDR and IPv6 support by @rylev in #2174
bump version to 2.2.0-pre0 by @dicej in #2177
docs(release-process): small amendment by @vdice in #2183
Port sqlite-libsql to new libsql client by @itowlson in #2148
Mutable access to request headers by @itowlson in #2187
print error msg when plugin binary is missing by @rajatjindal in #2189
fix statically linked build issue for aarch by @rajatjindal in #2179
remove workspace/all-targets from cross build cmd by @rajatjindal in #2192
Runtime tests services by @rylev in #2180
Update readme to latest template syntax by @tpmccallum in #2178
Stop testing kv and sqlite twice by @rylev in #2195
Rename 'Test Spin SDK - Rust' to 'Test Spin' by @rylev in #2197
remove Send and Sync bounds from Rust SDK router by @dicej in #2198
Add macro for generating runtime tests automatically by @rylev in #2196
Patched build.rs to run on systems without rustup. Added flake for ni… by @benwis in #2199
Remove unused files by @rylev in #2194
Docker Service for runtime tests by @rylev in #2193
Wasi HTTP runtime test by @rylev in #2201
chore(flake): Fix Darwin dependency on Accelerate by @endocrimes in #2204
Test that variables and components can be added in the same template by @itowlson in #2207
ignore asset globs from being watched when using direct-mounts by @karthik2804 in #2203
update configure aws creds action to v4 by @rajatjindal in #2191
Add random port support to Python services by @rylev in #2206
Remove redundant headers-env-routes-test by @rylev in #2208
feat(cli.rs): allow setting app log dir via SPIN_LOG_DIR env var by @vdice in #2209
ci(release): consolidate GH release logic by @vdice in #2185
Abstract the runtime used in runtime tests so that it's not hardcoded as Spin by @rylev in #2211
Don't pass services when constructing Spin instance in runtime test by @rylev in #2214
Update libsql to a crates.io reference by @itowlson in #2215
Generalize runtime testing framework to be a general testing Spin framework by @rylev in #2217
Update test to new Cloud plugin help text by @itowlson in #2219
ci(templates): update rust templates automation to use the crates.io versions by @vdice in #2221
update to Wasmtime 17 and WASI 0.2.0-rc-2023-12-05 by @dicej in #2222
E2E testing using testing framework by @rylev in #2223
Move rest of e2e tests over to new testing framework by @rylev in #2224
Provide feedback if it takes a while to download a remote component on spin up by @Archisman-Mridha in #2226
Warn instead of trace when errors happen in the spin_redis_engine by @karthik2804 in #2231
Move more integration tests to use the testing framework by @rylev in #2228
print active channels on redis trigger by @karthik2804 in #2232
SIP 016 - Inbound WebSocket Support by @dicej in #2212
bump PoolingAllocationConfig::max_core_instances_per_component to 200 by @dicej in #2234
Bump h2 from 0.3.22 to 0.3.24 by @dependabot in #2233
Bump shlex from 1.2.0 to 1.3.0 by @dependabot in #2239
Bump zerocopy from 0.7.29 to 0.7.32 by @dependabot in #2210
feat(up): Spawn multiple trigger commands by @carlokok in #2213
temporarily switch to Wasmtime commit 0b632023 by @dicej in #2243
cargo cfg: fix build on aarch64-linux by @endocrimes in #2240
logging: Emit wasmtime-wasi-http WARN logs by default by @lann in #2244
Add vault variable example by @tpmccallum in #2241
trigger-http: Log TLS startup errors instead of propagating by @lann in #2230
update to Wasmtime 17 and WASI 0.2.0 by @dicej in #2250
Include trigger type in trigger options help header by @itowlson in #2256
Cancel external triggers if one of multiple fails on start by @itowlson in #2248
Fix regrettable trigger help heading when no app by @itowlson in #2258
Allow only common trigger options in multi-trigger apps by @itowlson in #2257
chore(release): Spin v2.2 version bumps by @vdice in #2260

New Contributors

@benwis made their first contribution in #2199
@Archisman-Mridha made their first contribution in #2226
@carlokok made their first contribution in #2213

Full Changelog: v2.1.0...v2.2.0

Contributors

carlokok, lann, and 11 other contributors

Assets 10

14 Dec 20:22

github-actions

v2.1.0

4ca3a56

v2.1.0

Spin 2.1.0

The 2.1.0 release of Spin brings a number of features, improvements and bug fixes.

Some highlights at a glance:

(Rust SDK) Support for async functions in HTTP router: #2122
(Rust SDK) Publish SDK on crates.io: #2160
Update to Wasmtime 15, supporting both WASI 0.2.0-rc-2023-10-18 and 0.2.0-rc-2023-11-10: #2108
Support configuring plugins via spin.toml: #2104
(Redis trigger) Allow multiple components to receive each incoming pub/sub event: #2123
Interactive support for updating plugins: #2091
spin doctor support for converting manifests from v1 to v2: #2098
Experimental support for wasi-sockets: #2156

As always, thanks to contributors old and new for helping improve Spin on a daily basis! 🎉

Verifying the Release Signature

After downloading the 2.1.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.1.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha <sha> \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

docs(release-process): add update-cargo-locks by @vdice in #2008
ci(release): only config aws creds + upload to s3 if main by @vdice in #2009
Fix misleading guidance on disallowed host by @itowlson in #2006
chore(examples/tinygo-outbound-*): add allowed_outbound_hosts config by @vdice in #1978
fix warning message on spin add by @karthik2804 in #2015
README updated for 2.0 by @melissaklein24 in #1999
Refactor to keep variant descriptions together by @itowlson in #2021
Templates makefile: handle prerelease origin, handle Go v2 by @itowlson in #2022
Don't allow v2 components to be added to v1 manifest by @itowlson in #2025
fix comment for disabling wasmtime pooling by @endocrimes in #2026
Use a more future compatible TryIntoRequest trait for router by @rylev in #2013
log error if wasi:http/incoming-handler#handle fails post-response by @dicej in #2019
chore(*): rev to 2.1.0-pre0 by @vdice in #2048
When translating allowed_http_hosts allow both http and htttps by @rylev in #2042
Wit improvements by @rylev in #2058
Allow disabling app logging to disk with --log-dir "" by @lann in #2059
Update internal command list by @karthik2804 in #2053
Error at new time if name is not usable by @itowlson in #2056
fix(tests/integration): update plugin output assertion by @vdice in #2047
Remove the http crate from the Rust http template. by @rylev in #2065
Add a Response::set_header method to the Rust SDK by @rylev in #2066
Bump webpki from 0.22.1 to 0.22.4 by @dependabot in #2071
sdk/go/kv: add missing GetKeys() function by @deadprogram in #2075
Use forked Wasmtime 14.0.4 with backported fixes by @lann in #2076
Update wasmtime backport revision by @lann in #2082
fix non-streaming outgoing POST requests in Rust SDK by @dicej in #2083
manifest: Improve error messages for invalid component IDs by @lann in #2092
spin add check trigger compatibility for v2 by @itowlson in #2027
Allow hosts to control local loader download cache by @itowlson in #2095
Watch should not serve until there is a build by @itowlson in #2096
Add dotted_pascal_case template filter by @itowlson in #2097
Add toml_edit feature "serde" by @lann in #2099
remove unused e2e testing functions by @rajatjindal in #2100
chore(templates/tests): bump spin fileserver component to v0.2.1 by @vdice in #2103
Add manifest field for plugin settings by @itowlson in #2104
doctor: Add UpgradeDiagnosis for manifest v1->v2 by @lann in #2098
app: Remove App MaybeLoader constraint by @lann in #2106
Multiselect plugin upgrade by @joaogdemacedo in #2091
rust-sdk: Stub out un-disable-able 'http' feature by @lann in #2081
Always url encode authority when parsing OutboundUrl by @rylev in #2116
Runtime Testing POC by @rylev in #2062
Update to Wasmtime 15.0.0, support multiple WASI snapshots by @alexcrichton in #2108
Improve the outbound mysql runtime test and runtime test runner by @rylev in #2124
allow multiple components to be executed on same trigger by @karthik2804 in #2123
Bump openssl from 0.10.55 to 0.10.60 by @dependabot in #2121
Fix duplicate package warning from Rust SDK by @itowlson in #2132
Remove the sqlite e2e tests as the runtime tests make them redundant by @rylev in #2126
Add async support to the rust-sdk router by @fibonacci1729 in #2122
fix(trigger): don't panic if a component is not attached to a trigger by @Mossaka in #2133
Outbound Redis runtime test by @rylev in #2125
ref(docs): update to run/deploy via OCI by @vdice in #2129
Added examples to spin registry CLI commands, added Windows override to Makefile by @ogghead in #2135
chore(docs): manifest v2; redirect module to v0.1.0 by @vdice in #2118
Ensure assertion is outbound-redis test component is deterministic by @rylev in #2140
Improve error message for non-allowed host in outbound-http handler by @rylev in #2136
Fix two triggers not being able to use same component by @itowlson in #2145
retry http assertions a few times before failing by @rajatjindal in #2134
Make TimerTrigger example importable in other projects by @0xE282B0 in #2152
Key/Value runtime tests by @rylev in #2141
Outbound postgres runtime tests by @rylev in #2150
feat: add alias for spin commands by @nilslice in #2144
Add a runtime test for the variables interface by @rylev in #2154
Fix Windows error with HTTP components by @itowlson in #2159
rust-sdk: add more request helpers by @fibonacci1729 in #2157
Fix double backslashes in printed Windows paths by @itowlson in #2162
Statically linked spin by @rajatjindal in #2101
fix release yaml syntax by @rajatjindal in #2165
chore(cargo/sdk): prep for publishing spin-sdk crate by @vdice in #2151
ci(release.yml): add crates publishing job by @vdice in #2160
Fix "duplicate package key-value" warning in Spin SDK git reference by @itowlson in #2164
Fix Windows not copying globs or directories by @itowlson in #2161
add support for wasi:http/[email protected] by @dicej in #2166
ci(release): only upload spin static bin to release if semver tag by @vdice in #2169
Basic Socket Support by @rylev in #2156
Map correct token count for llm:InferencingResult by @Laur...

Contributors

deadprogram, alexcrichton, and 17 other contributors

Assets 8

10 Nov 18:50

github-actions

v2.0.1

1d72f1c

v2.0.1

Spin 2.0.1

This is a patch release of Spin containing performance and bug fixes.

Changes

Wasmtime: several changes were backported to a temporary fork of Wasmtime 14.0.4
- bytecodealliance/wasmtime#7475 fixes an HTTP performance regression.
- bytecodealliance/wasmtime#7426 fixes an issue with streaming outgoing HTTP request bodies.
Rust SDK
- #2083 fixes non-streaming outgoing POST requests
Go SDK
- #2075 adds a missing function to the KV API

Verifying the Release Signature 🔏

After downloading the v2.0.1 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.0.1 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

Assets 8

03 Nov 23:09

github-actions

v2.0.0

e4bb235

v2.0.0

Spin v2.0.0 🚀

We are excited to announce the release of Spin 2.0! This is the latest major release of Spin
which focuses on improving key scenarios for running WebAssembly applications.

What's new 💅

Component support

Spin 2.0 now supports running composed WebAssembly Components.
Dive into the examples mentioned below for a demonstration of this functionality.
Polyglot

Thanks to composition, Spin application developers can build polyglot applications incorporating components
built from any language with support for compiling into a WebAssembly component.
Portability

Spin has now standardized on wasi-http. This means components
built by Spin can be run by other runtimes supporting the same wasi-http version.
Performance

Spin 2.0 brings a big performance boost, utilizing wasmtime's pooling allocator and no longer
copying Request and Response bodies. In some cases, we've seen 10x the performance when compared to Spin 1.0!

Note: For Linux hosts, there is a known pending performance fix in wasmtime#7475
that will be ported to Spin as soon as available.

Check out the examples 👀

Dive into the Http Auth Middleware example for a demonstration of
using component composition to integrate an http auth middleware component into a Spin application.
Experimental streaming support also ships in this release, enabling a whole new suite of scenarios for Spin
application developers. See the Spin fileserver component for an example using this functionality.

Breaking changes ⚠️

OCI distribution: We've updated the way we distribute Spin apps to enable upstream scenarios
such as containerd and Kubernetes. This means pre-2.0 Spin clients won’t be able to pull or run Spin apps published by 2.0 Spin clients
- Fix: update to the 2.0 version of Spin
spin new / spin add - syntax is now spin new -t <template> <name>.
- spin new <template> no longer works; however, spin new and spin new <template> <name> still do
C# templates won’t work with Spin 2 yet (more generally, templates with custom filters won't, but to our knowledge C# was the only one)
v2 SDK and manifest related changes:
- After upgrading to use the v2 manifest,
  applications which use Postgres, MySQL or outbound Redis must provide an allowed_outbound_hosts configuration
- Multiple Rust API changes: outbound HTTP, outbound Redis, application variables
- Go has a new API for Redis
- Go key_value package has been renamed to kv and has a new API

Highlights since Spin 1.0 ✨

Here are some highlights you may have missed that shipped in the releases between 1.0 and 2.0:

DevEx/CLI
- spin watch to automatically rebuild and restart
  you Spin application when files change
- spin doctor to detect and fix issues with your Spin application
- All spin cloud commands now ship via the Spin Cloud Plugin which is automatically installed when you install Spin
Persistence/Data services
Runtime improvements
- Enabling wasmtime's pooling allocator for increased performance.
Language support
- Python SDK
- Go SDK adds support for outbound MySQL and Postgres

Thank you! ❤️

As always, many thanks to contributors old and new for helping improve Spin on a daily basis! 🎉 The 2.0 release represents
a huge milestone for the Spin project and we couldn't have done it without you.

Verifying the Release Signature 🔏

After downloading the v2.0.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.0.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha e4bb2357067d29f053b2d039476180ffa31222b2 \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

feat(templates): update sdk to v1.5.0 by @github-actions in #1765
chore(*): pre-release version bumps by @vdice in #1764
docs(README.md): sqlite storage is now supported in the go SDK by @vdice in #1757
chore(tests): add empty and one-byte assets to assets-test by @vdice in #1754
use upstream release-action and update version from 1.10.0 to 1.13.0 by @rajatjindal in #1769
sip: Update SIP 005 by @lann in #1753
When spin watch terminates spin up, allow it to delete its temp dir by @itowlson in #1723
sqlite: Add split module by @lann in #1772
Update MSRV to reflect Wasmtime requirement by @itowlson in #1782
Add spin up --build option by @itowlson in #1776
Don't run e2e that requires big runners on forks by @itowlson in #1789
Add llm support for wit-bindgen 0.2 based modules by @rylev in #1752
upload spin linux amd64 artifacts to S3 by @rajatjindal in #1777
Add llm import to other worlds by @itowlson in #1788
Skip AWS interaction on forks by @itowlson in #1792
syntax fix to run only on linux/amd64 by @rajatjindal in #1793
Refactor llm and add http compute option by @karthik2804 in #1790
Fix syntax to not configure AWS credentials on forks by @itowlson in #1798
separate out build and run e2e tests step by @rajatjindal in #1800
http: Make base = "/" the default by @lann in #1803
Create .spin/sqlite_db.db only if needed by @itowlson in #1799
Update to wasmtime 13 by @rylev in #1763
add backport example to release-process.md by @michelleN in #1810
feat(templates): update sdk to v1.5.1 by @github-actions in #1814
add CARGO_TARGET_DIR/{debug,release} to path by @rajatjindal in #1422
e2e-tests: disable connection pool by @rajatjindal in #1815
Make local llm support an on-by-default feature by @rylev in #1802
chore(docs): re-add base config to spin.toml by @vdice in #1820
Fix Postgres NULL attempting type conversion by @itowlson in #1816
Rescue space for Linux unit tests to run for now by @itowlson in #1829
Remove Hippo dependency by @itowlson in #1824
reuse sqlite connection in golang sdk by @rajatjindal in #1827
Plugins search by @itowlson in #1823
Respect SPIN_ALWAYS_BUILD on registry push by @itowlson in #1830
Expose an API to push a LockedApp to a registry by @itowlson in #1825
feat(oci): inline content when applicable by default by @vdice in #1821
Reconfigure spin watch on manifest change by @itowlson in #1784
Bump versions to 2.0.0-pre0 by @lann in #1834
Remove template custom filters feature by @itowlson in #1822
Remove bindle by @lann in #1835
Always print warning on blocked outbound HTTP by @itowlson in #1833
Replace foo-bar header with content-type by @itowlson in #1843
makefile and CI tweaks by @dicej in #1846
Update spin-componentize to f29cdb2 by @rylev in https://github.com/fer...

Contributors

lann, rajatjindal, and 12 other contributors

Assets 8

Releases: fermyon/spin

v2.4.3

Spin 2.4.3

Verifying the Release Signature 🔏

Addendum: Due to #2502, the spin-v2.4.3-macos-amd64.tar.gz archive has been rebuilt, signed and uploaded manually.

Contributors

v2.4.2

Spin 2.4.2

Verifying the Release Signature 🔏

v2.4.1

Spin 2.4.1

Verifying the Release Signature 🔏

v2.4.0

Spin v2.4

Verifying the Release Signature

What's Changed

New Contributors

Contributors

v2.3.1

Spin 2.3.1

Changes

Verifying the Release Signature 🔏

v2.3.0

Spin 2.3.0

Verifying the Release Signature

What's Changed

Contributors

v2.2.0

Spin 2.2.0

Some highlights in v2.2.0 at a glance:

Additional features worth mentioning:

Verifying the Release Signature

What's Changed

New Contributors

Contributors

v2.1.0

Spin 2.1.0

Verifying the Release Signature

What's Changed

Contributors

v2.0.1

Spin 2.0.1

Changes

Verifying the Release Signature 🔏

v2.0.0

Spin v2.0.0 🚀

What's new 💅

Check out the examples 👀

Breaking changes ⚠️

Highlights since Spin 1.0 ✨

Thank you! ❤️

Verifying the Release Signature 🔏

What's Changed

Contributors

Addendum: Due to #2502, the `spin-v2.4.3-macos-amd64.tar.gz` archive has been rebuilt, signed and uploaded manually.